PRIVACY POLICY

Last updated: August 7, 2026

At WODira, we take the privacy of your data very seriously. This Privacy Policy explains how we collect, use, share and protect the personal information of Users (Athletes/Spectators) and Organizers who use our platform.

This policy has been drafted in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).

2. WHAT DATA DO WE COLLECT?

Depending on your role in the app (Organizer or Athlete), we may collect:

2.1. User Data (Athletes/Spectators)

Identification data: First name, last name, national identity document details when required for invoicing, email address and telephone number.
Sports profile data: Gender, date of birth, home box or gym, competition category (for example, RX or Scaled) and T-shirt size for welcome packs.
Transaction data: History of ticket purchases and registrations.
Technical registration security metadata: Country, region, city, time zone, network and VPN, proxy or Tor signals obtained approximately from the IP address. We do not retain the IP address or exact coordinates in the order.

2.2. Organizer Data

Professional and contact data: Representative's name, company name, tax identification number, address, email and telephone number.
Financial data: Information required to transfer the collected funds, managed through Stripe Connect.

2.3. Payment Data

Important: WODira does NOT store your complete credit or debit card details. These details are managed directly by our payment provider, Stripe, under its own security standards (PCI DSS). WODira only receives a transaction token or identifier.

3. WHAT DO WE USE YOUR DATA FOR? (PURPOSE)

We process your data for the following purposes:

Service management: Creating your user account, processing ticket purchases and managing your registration for events.
Communication: Sending purchase confirmations, tickets (QR) and important notifications about changes to events, such as schedules or cancellations.
Running the competition (disclosure to the Organizer): Transferring your registration data to the event Organizer so that they can create start lists, manage heats, time the competition and publish results (leaderboards).
Legal and tax compliance: Invoicing and accounting.
Support: Responding to questions or technical incidents.
Security and fraud prevention: Detecting and reviewing unusual attempts during the registration and payment process.

4. WHAT IS THE LEGAL BASIS FOR PROCESSING?

The legal basis for processing your data depends on the purpose:

Performance of a contract: We need your data to process the ticket purchase and enable you to participate in the event. Without this data, we cannot provide the service.
Legal obligation: To comply with tax, invoicing and consumer protection regulations.
Consent: When you subscribe to a newsletter or accept non-essential cookies, where applicable. We also rely on your consent to send you WODira news, campaigns and resources when you enable the marketing preference.

5. WHO DO WE SHARE YOUR DATA WITH? (RECIPIENTS)

WODira operates as a Marketplace, so sharing data is essential for the service to function.

5.1. Disclosure to Event Organizers

When you register for an event, WODira discloses your identification and sports data to the Organizer of that event.

Purpose: Managing the competition, event sports insurance and access control.

Responsibility: Once the data has been disclosed, the Organizer becomes an independent Data Controller for that data in relation to the management of their event.

5.2. Service Providers (Data Processors)

We share only the data strictly necessary with providers that help us operate, under confidentiality agreements:

Payment gateway: Stripe Payments Europe, Ltd., to process charges and payments.
Hosting and database: Amazon Web Services, to host the platform.
Email marketing: Listmonk, self-hosted by WODira, to manage newsletters, campaigns, unsubscribes and communication preferences.
Accounting services: To meet our tax obligations.
IP intelligence: IPQuery, ipwho.is, ipapi.is and ipapi.co. In production, the browser may optionally query one of these providers to obtain approximate network and location metadata during a registration.
Accommodation: Stay22. For enabled events, we display results and interactive maps of nearby accommodation. The external map is loaded only when requested by the user. When the map is loaded or an affiliate link is followed, Stay22 receives the technical data required to provide the service and attribute possible bookings.

5.3. Publication of Results

By participating in a competitive sporting event, you accept that your first name, last name, category, club or box and scores will be public in rankings (leaderboards) within the app and the event website, due to the inherently public nature of the sporting competition.

6. INTERNATIONAL TRANSFERS

Our main servers are located in Europe. If we use providers located outside the European Economic Area, such as Stripe in the United States, we ensure that they provide appropriate safeguards, such as participation in the EU-US Data Privacy Framework (DPF) or the use of Standard Contractual Clauses (SCCs) approved by the European Commission.

7. DATA RETENTION

Active users: We will retain your data while your account remains active.
Transaction data: This will be retained for the mandatory legal period, generally four or five years, to comply with tax obligations.
Technical registration security metadata: This is retained with the transaction record for five years.

If you request deletion of your account, we will restrict access to your data and retain it only for the applicable statutory limitation periods in order to address potential liabilities.

8. YOUR RIGHTS

You may exercise your rights free of charge by writing to privacidad@wodira.app:

Access: Find out what data we hold about you.
Rectification: Correct inaccurate data.
Erasure (the “right to be forgotten”): Ask us to delete your data when it is no longer necessary.
Restriction: Ask us to suspend the use of your data.
Portability: Request your data in a structured format.

If you believe that we have not processed your data correctly, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).